foreman_puppet 0.0.1

data/test/controllers/foreman_puppet/api/v2/template_combinations_controller_test.rb

@@ -0,0 +1,81 @@
+require 'test_puppet_helper'
+
+module ForemanPuppet
+  module Api
+    module V2
+      class TemplateCombinationsControllerTest < ActionController::TestCase
+        tests ::Api::V2::TemplateCombinationsController
+
+        let(:environment) { FactoryBot.create(:environment) }
+        let(:template_combination) { FactoryBot.create(:template_combination) }
+
+        test 'should get index by environment' do
+          FactoryBot.create(:template_combination, environment: template_combination.environment)
+          get :index, params: { environment_id: template_combination.environment.to_param }
+          json_response = ActiveSupport::JSON.decode(@response.body)
+          assert_equal 2, json_response['results'].size, 'Should contain template_combinations in the response'
+          assert_response :success
+        end
+
+        context 'with provisioning_template_id' do
+          setup do
+            Foreman::Deprecation.stubs(:api_deprecation_warning).never
+          end
+
+          test 'should get index' do
+            FactoryBot.create(:template_combination, provisioning_template: template_combination.provisioning_template)
+            get :index, params: { provisioning_template_id: template_combination.provisioning_template.id }
+            json_response = ActiveSupport::JSON.decode(@response.body)
+            assert_equal 2, json_response['results'].size, 'Should contain template_combinations in the response'
+            assert_response :success
+          end
+
+          test 'should get template combination for template' do
+            get :show, params: { provisioning_template_id: template_combination.provisioning_template.to_param, id: template_combination.id }
+            assert_response :success
+            json_response = ActiveSupport::JSON.decode(@response.body)
+            assert_not json_response.empty?
+            assert_equal json_response['provisioning_template_id'], template_combination.provisioning_template_id
+          end
+
+          test 'should get template combination for environment' do
+            get :show, params: { provisioning_template_id: template_combination.provisioning_template.to_param, id: template_combination.id }
+            assert_response :success
+            json_response = ActiveSupport::JSON.decode(@response.body)
+            assert_not json_response.empty?
+            assert_equal json_response['environment_id'], template_combination.environment_id
+            assert_equal json_response['environment_name'], template_combination.environment.name
+          end
+
+          test 'should create valid' do
+            as_admin do
+              post :create, params: { template_combination: { environment_id: environment.id, hostgroup_id: hostgroups(:unusual).id },
+                                      provisioning_template_id: template_combination.provisioning_template.id }
+            end
+            json_response = ActiveSupport::JSON.decode(@response.body)
+            assert_equal(json_response['environment_id'], environment.id)
+            assert_equal(json_response['hostgroup_id'], hostgroups(:unusual).id)
+            assert_equal(json_response['provisioning_template_id'], template_combination.provisioning_template.id)
+            assert_response :created
+          end
+
+          test 'should update template combination' do
+            put :update, params: { template_combination: { environment_id: environment.id, hostgroup_id: hostgroups(:common).id },
+                                   environment_id: template_combination.environment.id, id: template_combination.id }
+
+            json_response = ActiveSupport::JSON.decode(@response.body)
+            assert_equal(json_response['environment_id'], environment.id)
+            assert_equal(json_response['hostgroup_id'], hostgroups(:common).id)
+            assert_response :success
+          end
+
+          test 'should destroy' do
+            delete :destroy, params: { id: template_combination.id }
+            assert_response :ok
+            assert_not TemplateCombination.exists?(template_combination.id)
+          end
+        end
+      end
+    end
+  end
+end

data/test/controllers/foreman_puppet/config_groups_controller_test.rb

@@ -0,0 +1,47 @@
+require 'test_puppet_helper'
+
+module ForemanPuppet
+  class ConfigGroupsControllerTest < ActionController::TestCase
+    setup do
+      @routes = ForemanPuppet::Engine.routes
+    end
+
+    basic_pagination_per_page_test
+    basic_pagination_rendered_test
+
+    test 'should get index' do
+      get :index, session: set_session_user
+      assert_response :success
+      assert_not_empty assigns(:config_groups)
+    end
+
+    test 'should get new' do
+      get :new, session: set_session_user
+      assert_response :success
+    end
+
+    test 'should create config_group' do
+      assert_difference('ForemanPuppet::ConfigGroup.count') do
+        post :create, params: { config_group: { name: 'Custom Dev Group' } }, session: set_session_user
+      end
+      assert_redirected_to config_groups_path
+    end
+
+    test 'should get edit' do
+      get :edit, params: { id: config_groups(:one) }, session: set_session_user
+      assert_response :success
+    end
+
+    test 'should update config_group' do
+      put :update, params: { id: config_groups(:one), config_group: { name: 'new name' } }, session: set_session_user
+      assert_redirected_to config_groups_path
+    end
+
+    test 'should destroy config_group' do
+      assert_difference('ForemanPuppet::ConfigGroup.count', -1) do
+        delete :destroy, params: { id: config_groups(:three) }, session: set_session_user
+      end
+      assert_redirected_to config_groups_path
+    end
+  end
+end

data/test/controllers/foreman_puppet/environments_controller_test.rb

@@ -0,0 +1,230 @@
+require 'test_puppet_helper'
+
+module ForemanPuppet
+  class EnvironmentsControllerTest < ActionController::TestCase
+    setup do
+      @routes = ForemanPuppet::Engine.routes
+      @model = FactoryBot.create(:environment)
+    end
+
+    basic_index_test(:environments)
+    basic_new_test
+    basic_edit_test(:environment)
+    basic_pagination_per_page_test
+    basic_pagination_rendered_test
+
+    test 'should create new environment' do
+      assert_difference -> { ForemanPuppet::Environment.unscoped.count } do
+        post :create, params: { commit: 'Create', environment: { name: 'some_environment' } }, session: set_session_user
+      end
+      assert_redirected_to environments_path
+    end
+
+    test 'should update environment' do
+      setup_users
+      environment = Environment.new name: 'some_environment'
+      assert environment.save!
+
+      put :update, params: { commit: 'Update', id: environment.name, environment: { name: 'other_environment' } }, session: set_session_user
+      env = Environment.unscoped.find(environment.id)
+      assert_equal('other_environment', env.name)
+
+      assert_redirected_to environments_path
+    end
+
+    test 'should destroy environment' do
+      setup_users
+      environment = Environment.new name: 'some_environment'
+      assert environment.save!
+
+      assert_difference('Environment.unscoped.count', -1) do
+        delete :destroy, params: { id: environment.name }, session: set_session_user
+      end
+
+      assert_redirected_to environments_path
+    end
+
+    describe 'environments import' do
+      let(:puppet_proxy) { FactoryBot.create(:puppet_smart_proxy) }
+
+      test 'should import as admin when organization changed' do
+        setup_import_classes
+        Organization.current = taxonomies(:organization2)
+        post :obsolete_and_new, params:
+          { 'changed' =>
+            { 'new' =>
+              { 'env1' => '{"a":{"new":{}}}' }  }  }, session: set_session_user
+        assert_redirected_to environments_url
+      end
+
+      test 'should handle disk environment containing additional classes' do
+        setup_import_classes
+        Environment.find_by(name: 'env1').puppetclasses.delete(Puppetclass.find_by(name: 'a'))
+        #    db_tree   of {"env1" => ["b", "c"],     "env2" => ["a", "b", "c"]}
+        #    disk_tree of {"env1" => ["a", "b", "c"],"env2" => ["a", "b", "c"]}
+        get :import_environments, params: { proxy: puppet_proxy }, session: set_session_user
+        assert_template 'common/_puppetclasses_or_envs_changed'
+        assert_select 'input#changed_new_env1'
+        post :obsolete_and_new, params:
+          { 'changed' =>
+            { 'new' =>
+              { 'env1' => '{"a":{"new":{}}}' }  }  }, session: set_session_user
+        assert_redirected_to environments_url
+        assert_equal 'Successfully updated environments and Puppet classes from the on-disk Puppet installation', flash[:success]
+        assert_equal %w[a b c],
+          Environment.unscoped.find_by(name: 'env1').puppetclasses.map(&:name).sort
+      end
+
+      test 'should handle disk environment containing less classes' do
+        setup_import_classes
+        as_admin { Puppetclass.create(name: 'd') }
+        Environment.find_by(name: 'env1').puppetclasses << Puppetclass.find_by(name: 'd')
+        # db_tree   of {"env1" => ["a", "b", "c", "d"], "env2" => ["a", "b", "c"]}
+        # disk_tree of {"env1" => ["a", "b", "c"],      "env2" => ["a", "b", "c"]}
+        get :import_environments, params: { proxy: puppet_proxy }, session: set_session_user
+        assert_template 'common/_puppetclasses_or_envs_changed'
+        assert_select 'input#changed_obsolete_env1[value*="d"]'
+        post :obsolete_and_new,
+          params: { 'changed' =>
+            { 'obsolete' =>
+              { 'env1' => '["d"]' } } }, session: set_session_user
+        assert_redirected_to environments_url
+        assert_equal 'Successfully updated environments and Puppet classes from the on-disk Puppet installation', flash[:success]
+        envs = Environment.unscoped.find_by(name: 'env1').puppetclasses.map(&:name).sort
+        assert_equal %w[a b c], envs
+      end
+      test 'should handle disk environment containing less environments' do
+        setup_import_classes
+        as_admin { Environment.create(name: 'env3') }
+        # db_tree   of {"env1" => ["a", "b", "c"], "env2" => ["a", "b", "c"], "env3" => []}
+        # disk_tree of {"env1" => ["a", "b", "c"], "env2" => ["a", "b", "c"]}
+        get :import_environments, params: { proxy: puppet_proxy.id }, session: set_session_user
+        assert_template 'common/_puppetclasses_or_envs_changed'
+        assert_select 'input#changed_obsolete_env3'
+        post :obsolete_and_new, params:
+          { 'changed' =>
+            { 'obsolete' =>
+              { 'env3' => '[]' } } }, session: set_session_user
+        assert_redirected_to environments_url
+        assert_equal 'Successfully updated environments and Puppet classes from the on-disk Puppet installation', flash[:success]
+        assert_equal [], Environment.unscoped.find_by(name: 'env3').puppetclasses.map(&:name).sort
+      end
+
+      test 'should fail to remove active environments' do
+        disable_orchestration
+        setup_import_classes
+        as_admin do
+          host = FactoryBot.create(:host)
+          Environment.find_by(name: 'env1').puppetclasses += [FactoryBot.create(:puppetclass)]
+          host.attributes = { puppet_attributes: { environment_id: Environment.find_by(name: 'env1').id } }
+          assert host.save!
+          assert_empty host.errors
+          assert Environment.find_by(name: 'env1').hosts.count.positive?
+        end
+
+        # assert_template "puppetclasses_or_envs_changed". This assertion will fail. And it should fail. See above.
+        post :obsolete_and_new, params:
+          { 'changed' =>
+           { 'obsolete' =>
+            { 'env1' => '["a","b","c","_destroy_"]' } } }, session: set_session_user
+        assert Environment.unscoped.find_by(name: 'env1').hosts.count.positive?
+        # assert flash[:error] =~ /^Failed to update the environments and puppetclasses from the on-disk puppet installation/
+        assert Environment.unscoped.find_by(name: 'env1')
+      end
+
+      test 'should obey config/ignored_environments.yml' do
+        @request.env['HTTP_REFERER'] = environments_url
+        setup_import_classes
+        as_admin do
+          Environment.create name: 'env3'
+          Environment.find_by(name: 'env2').destroy
+        end
+        # db_tree   of {"env1" => ["a", "b", "c"], "env3" => []}
+        # disk_tree of {"env1" => ["a", "b", "c"], "env2" => ["a", "b", "c"]}
+
+        PuppetClassImporter.any_instance.stubs(:ignored_environments).returns(%w[env1 env2 env3])
+        get :import_environments, params: { proxy: puppet_proxy }, session: set_session_user
+
+        assert_equal "No changes to your environments detected\nIgnored environments: env1, env2, and env3", flash[:info]
+      end
+
+      test 'should obey puppet class filters in config/ignored_environments.yml' do
+        setup_import_classes
+        PuppetClassImporter.any_instance.stubs(:updated_classes_for).returns([])
+        PuppetClassImporter.any_instance.stubs(:removed_classes_for).returns([])
+
+        PuppetClassImporter.any_instance.stubs(:ignored_environments).returns([])
+        PuppetClassImporter.any_instance.stubs(:ignored_classes).returns([/^a$/])
+        get :import_environments, params: { proxy: puppet_proxy }, session: set_session_user
+
+        assert_equal "No changes to your environments detected\nIgnored classes in the environments: env1 and env2", flash[:info]
+      end
+
+      test 'it adds a warning when boolean keys are found' do
+        setup_import_classes
+        PuppetClassImporter.any_instance.stubs(:ignored_environments).returns([true])
+
+        get :import_environments, params: { proxy: puppet_proxy }, session: set_session_user
+        assert_equal 'Ignored environment names resulting in booleans found. Please quote strings like true/false and yes/no in config/ignored_environments.yml', flash[:warning]
+      end
+
+      test 'user with viewer rights should fail to edit an environment' do
+        setup_user
+        get :edit, params: { id: environments(:production).name }, session: set_session_user.merge(user: users(:one).id)
+        assert_equal(403, @response.status)
+      end
+
+      test 'user with viewer rights should succeed in viewing environments' do
+        setup_user
+        get :index, session: set_session_user
+        assert_response :success
+      end
+
+      test "should accept environment with name 'name'" do
+        @request.env['HTTP_REFERER'] = environments_url
+        ProxyAPI::Puppet.any_instance.stubs(:environments).returns(['new'])
+        post :obsolete_and_new, params:
+          { 'changed' =>
+           { 'new' =>
+            { 'new' => '{"a":{"new":{}}}' } } }, session: set_session_user
+        assert_includes(Environment.unscoped.all.map(&:name), 'new', 'Should include environment with name "new"')
+      end
+
+      private
+
+      def setup_import_classes
+        as_admin do
+          Host::Managed.all.each { |h| h.update(environment_id: nil) }
+          Hostgroup.all.each { |h| h.update(environment_id: nil) }
+          Puppetclass.destroy_all
+          Environment.destroy_all
+        end
+        @request.env['HTTP_REFERER'] = environments_url
+        # This is the database status
+        # and should result in a db_tree of {"env1" => ["a", "b", "c"], "env2" => ["a", "b", "c"]}
+        orgs = [taxonomies(:organization1)]
+        locs = [taxonomies(:location1)]
+        as_admin do
+          klasses = %w[a b c].map { |name| FactoryBot.create :puppetclass, name: name }
+          %w[env1 env2].each do |name|
+            env = FactoryBot.create :environment, name: name, organizations: orgs, locations: locs
+            env.puppetclasses += klasses
+          end
+        end
+        # This is the on-disk status
+        # and should result in a disk_tree of {"env1" => ["a", "b", "c"],"env2" => ["a", "b", "c"]}
+        envs = HashWithIndifferentAccess.new(env1: %w[a b c], env2: %w[a b c])
+        pcs = [HashWithIndifferentAccess.new('a' => { 'name' => 'a', 'module' => '', 'params' => {} })]
+        classes = Hash[pcs.map { |k| [k.keys.first, Foreman::ImporterPuppetclass.new(k.values.first)] }]
+        Environment.expects(:puppetEnvs).returns(envs).at_least(0)
+        ProxyAPI::Puppet.any_instance.stubs(:environments).returns(%w[env1 env2])
+        ProxyAPI::Puppet.any_instance.stubs(:classes).returns(classes)
+      end
+    end
+
+    def setup_user
+      @request.session[:user] = users(:one).id
+      users(:one).roles       = [Role.default, Role.find_by(name: 'Viewer')]
+    end
+  end
+end

data/test/controllers/foreman_puppet/hostgroups_controller_test.rb

@@ -0,0 +1,72 @@
+require 'test_puppet_helper'
+
+module ForemanPuppet
+  class HostgroupsControllerTest < ActionController::TestCase
+    tests ::HostgroupsController
+
+    setup do
+      @routes = ForemanPuppet::Engine.routes
+    end
+
+    describe '#environment_selected' do
+      setup do
+        @environment = FactoryBot.create(:environment)
+        @puppetclass = FactoryBot.create(:puppetclass)
+        @hostgroup = FactoryBot.create(:hostgroup, :with_puppet_enc, environment: @environment)
+        @params = {
+          id: @hostgroup.id,
+          hostgroup: {
+            name: @hostgroup.name,
+            environment_id: '',
+            puppetclass_ids: [@puppetclass.id],
+          },
+        }
+      end
+
+      test 'should return the selected puppet classes on environment change' do
+        assert_equal 0, @hostgroup.puppet.puppetclasses.length
+
+        post :environment_selected, params: @params, session: set_session_user, xhr: true
+        assert_equal(1, assigns(:hostgroup).puppet.puppetclasses.length)
+        assert_include assigns(:hostgroup).puppet.puppetclasses, @puppetclass
+      end
+
+      context 'environment_id param is set' do
+        test 'it will take the hostgroup params environment_id' do
+          other_environment = FactoryBot.create(:environment)
+          @params[:hostgroup][:environment_id] = other_environment.id
+
+          post :environment_selected, params: @params, session: set_session_user, xhr: true
+          assert_equal assigns(:environment), other_environment
+        end
+      end
+
+      test 'should not escape lookup values on environment change' do
+        hostgroup = FactoryBot.create(:hostgroup, :with_puppet_enc, environment: @environment, puppetclasses: [@puppetclass])
+        lookup_key = FactoryBot.create(:puppetclass_lookup_key, :array, default_value: %w[a b],
+                                                                        override: true,
+                                                                        puppetclass: @puppetclass,
+                                                                        overrides: { "hostgroup=#{hostgroup.name}" => %w[c d] })
+        lookup_value = lookup_key.lookup_values.first
+        FactoryBot.create(:environment_class, puppetclass: @puppetclass, environment: @environment, puppetclass_lookup_key: lookup_key)
+
+        # sending exactly what the host form would send which is lookup_value.value_before_type_cast
+        lk = { 'lookup_values_attributes' => { lookup_key.id.to_s => { 'value' => lookup_value.value_before_type_cast,
+                                                                       'id' => lookup_value.id,
+                                                                       'lookup_key_id' => lookup_key.id,
+                                                                       '_destroy' => false } } }
+
+        params = {
+          hostgroup_id: hostgroup.id,
+          hostgroup: hostgroup.attributes.merge(lk),
+        }
+
+        # environment change calls puppetclass_parameters which caused the extra escaping
+        post :puppetclass_parameters, params: params, session: set_session_user, xhr: true
+
+        # if this was escaped during refresh_host the value in response.body after unescapeHTML would include "[\\\"c\\\",\\\"d\\\"]"
+        assert_includes CGI.unescapeHTML(response.body), '["c","d"]'
+      end
+    end
+  end
+end

data/test/controllers/foreman_puppet/hosts_controller_test.rb

@@ -0,0 +1,346 @@
+require 'test_puppet_helper'
+
+module ForemanPuppet
+  class HostsControllerTest < ActionController::TestCase
+    tests ::HostsController
+
+    setup do
+      @routes = ForemanPuppet::Engine.routes
+      as_admin do
+        host1
+        host2
+      end
+    end
+
+    let(:org) { users(:one).organizations.first }
+    let(:loc) { users(:one).locations.first }
+    let(:environment1) { FactoryBot.create(:environment, organizations: [org], locations: [loc]) }
+    let(:environment2) { FactoryBot.create(:environment, organizations: [org], locations: [loc]) }
+    let(:hostgroup) { FactoryBot.create(:hostgroup, :with_puppet_enc, environment: environment2, organizations: [org], locations: [loc]) }
+    let(:host_defaults) { { hostgroup: hostgroup, environment: environment1, organization: org, location: loc } }
+    let(:host1) { FactoryBot.create(:host, :with_puppet_enc, :with_puppetclass, host_defaults) }
+    let(:host2) { FactoryBot.create(:host, :with_puppet_enc, :with_puppetclass, host_defaults) }
+
+    test 'user with edit host rights with update environments should change environments' do
+      @request.env['HTTP_REFERER'] = '/hosts'
+      setup_user 'edit', 'hosts'
+
+      post :update_multiple_environment, params: { host_ids: [host1.id, host2.id],
+                                                   environment: { id: environment2.id } },
+                                         session: set_session_user(:one)
+      assert_equal environment2.id, host1.reload.puppet.environment_id
+      assert_equal environment2.id, host2.reload.puppet.environment_id
+      assert_equal 'Updated hosts: changed environment', flash[:success]
+    end
+
+    test 'should inherit the hostgroup environment if *inherit from hostgroup* selected' do
+      @request.env['HTTP_REFERER'] = '/hosts'
+      setup_user 'edit', 'hosts'
+
+      params = { host_ids: [host1.id, host2.id], environment: { id: 'inherit' } }
+      post :update_multiple_environment, params: params, session: set_session_user(:one)
+
+      assert_equal hostgroup.puppet.environment_id, host1.reload.puppet.environment_id
+      assert_equal hostgroup.puppet.environment_id, host2.reload.puppet.environment_id
+    end
+
+    describe '#edit' do
+      setup { @routes = Rails.application.routes }
+
+      test 'lookup value and description should be html escaped' do
+        skip 'Needs complete migration to be done' unless ForemanPuppet.extracted_from_core?
+        FactoryBot.create(:puppetclass_lookup_key,
+          default_value: "<script>alert('hacked!');</script>",
+          description: "<script>alert('hacked!');</script>",
+          puppetclass: host1.puppet.puppetclasses.first)
+        get :edit, params: { id: host1.to_param }, session: set_session_user
+        assert_not response.body.include?('<script>alert(')
+        assert_includes response.body, '&lt;script&gt;alert('
+        assert_equal 2, response.body.scan('&lt;script&gt;alert(').count
+      end
+    end
+
+    describe '#hostgroup_or_environment_selected' do
+      let(:hostgroup) { FactoryBot.create(:hostgroup, :with_puppet_enc, organizations: [org], locations: [loc]) }
+
+      test 'choosing only one of hostgroup or environment renders classes' do
+        post :hostgroup_or_environment_selected, params: {
+          host_id: nil,
+          host: {
+            puppet_attributes: {
+              environment_id: environment1.id,
+            },
+          },
+        }, session: set_session_user, xhr: true
+        assert_response :success
+        assert_template partial: 'hosts/_form_puppet_enc_tab'
+      end
+
+      test 'choosing both hostgroup and environment renders classes' do
+        post :hostgroup_or_environment_selected, params: {
+          host_id: host1.id,
+          host: {
+            hostgroup_id: hostgroup.id,
+            puppet_attributes: {
+              environment_id: environment1.id,
+            },
+          },
+        }, session: set_session_user, xhr: true
+        assert_response :success
+        assert_template partial: 'hosts/_form_puppet_enc_tab'
+      end
+
+      test 'should not escape lookup values on environment change' do
+        host = FactoryBot.create(:host, :with_puppet_enc, :with_puppetclass)
+
+        host.environment.locations = [host.location]
+        host.environment.organizations = [host.organization]
+
+        lookup_key = FactoryBot.create(:puppetclass_lookup_key, :array, default_value: %w[a b],
+                                                                        override: true,
+                                                                        puppetclass: host.puppet.puppetclasses.first,
+                                                                        overrides: { "fqdn=#{host.fqdn}" => %w[c d] })
+        lookup_value = lookup_key.lookup_values.first
+
+        # sending exactly what the host form would send which is lookup_value.value_before_type_cast
+        lk_params = { 'lookup_values_attributes' => { lookup_key.id.to_s => { 'value' => lookup_value.value_before_type_cast,
+                                                                              'id' => lookup_value.id,
+                                                                              'lookup_key_id' => lookup_key.id,
+                                                                              '_destroy' => false } } }
+        params = {
+          host_id: host.id,
+          host: host.attributes.merge(lk_params),
+        }
+
+        # environment change calls puppetclass_parameters which caused the extra escaping
+        post :puppetclass_parameters, params: params, session: set_session_user, xhr: true
+
+        # if this was escaped during refresh_host the value in response.body after unescapeHTML would include "[\\\"c\\\",\\\"d\\\"]"
+        assert_includes CGI.unescapeHTML(response.body), '["c","d"]'
+      end
+    end
+
+    describe 'setting puppet proxy on multiple hosts' do
+      test 'should change the puppet proxy' do
+        proxy = FactoryBot.create(:puppet_smart_proxy)
+
+        @request.env['HTTP_REFERER'] = '/hosts'
+        params = { host_ids: [host1.id, host2.id], proxy: { proxy_id: proxy.id } }
+
+        setup_user 'edit', 'hosts'
+        post :update_multiple_puppet_proxy, params: params, session: set_session_user(:one)
+
+        assert_empty flash[:error]
+
+        set_admin
+        [host1, host2].each do |host|
+          assert_equal proxy, host.reload.puppet_proxy
+        end
+      end
+
+      test 'should clear the puppet proxy of multiple hosts' do
+        @request.env['HTTP_REFERER'] = '/hosts'
+
+        params = { host_ids: [host1.id, host2.id], proxy: { proxy_id: '' } }
+
+        setup_user 'edit', 'hosts'
+        post :update_multiple_puppet_proxy, params: params, session: set_session_user(:one)
+
+        assert_empty flash[:error]
+
+        set_admin
+        [host1, host2].each do |host|
+          assert_nil host.reload.puppet_proxy
+        end
+      end
+    end
+
+    describe '#externalNodes' do
+      test 'externalNodes should render YAML hashes correctly' do
+        HostInfoProviders::PuppetInfo.any_instance.expects(:classes_info_hash).returns(
+          'dhcp' => {
+            'bootfiles' => [
+              { 'name' => 'foo', 'mount_point' => '/bar' }.with_indifferent_access,
+              { 'name' => 'john', 'mount_point' => '/doe' }.with_indifferent_access,
+            ],
+          }
+        ).at_least_once
+
+        get :externalNodes, params: { name: host1.name, format: 'yml' }, session: set_session_user
+        assert_response :success
+        enc = nil
+        as_admin { enc = host1.info.deep_stringify_keys.to_yaml }
+        assert_equal enc, response.body
+      end
+
+      test 'externalNodes should render correctly when format text/html is given' do
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name }, session: set_session_user
+        assert_response :success
+        as_admin { @enc = host1.info.to_yaml }
+        assert_equal "<pre>#{ERB::Util.html_escape(@enc)}</pre>", response.body
+      end
+
+      test 'externalNodes should render yml request correctly' do
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }, session: set_session_user
+        assert_response :success
+        as_admin { @enc = host1.info.deep_stringify_keys.to_yaml(line_width: -1) }
+        assert_equal @enc, response.body
+      end
+
+      test 'when ":restrict_registered_smart_proxies" is false, HTTP requests should be able to get externalNodes' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = false
+        SETTINGS[:require_ssl] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts with a registered smart proxy on should get externalNodes successfully' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts without a registered smart proxy on should not be able to get externalNodes' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['another.host'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_equal 403, @response.status
+      end
+
+      test 'hosts with a registered smart proxy and SSL cert should get externalNodes successfully' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = 'CN=else.where'
+        @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts in trusted hosts list and SSL cert should get externalNodes successfully' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        Setting[:trusted_hosts] = ['else.where']
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = 'CN=else.where'
+        @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts with comma-separated SSL DN should get externalNodes successfully' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        Setting[:trusted_hosts] = ['foreman.example']
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = 'CN=foreman.example,OU=PUPPET,O=FOREMAN,ST=North Carolina,C=US'
+        @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts with slash-separated SSL DN should get externalNodes successfully' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        Setting[:trusted_hosts] = ['foreman.linux.lab.local']
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = '/C=US/ST=NC/L=City/O=Example/OU=IT/CN=foreman.linux.lab.local/emailAddress=user@example.com'
+        @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'hosts without a registered smart proxy but with an SSL cert should not be able to get externalNodes' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = 'CN=another.host'
+        @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_equal 403, @response.status
+      end
+
+      test 'hosts with an unverified SSL cert should not be able to get externalNodes' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+
+        @request.env['HTTPS'] = 'on'
+        @request.env['SSL_CLIENT_S_DN'] = 'CN=else.where'
+        @request.env['SSL_CLIENT_VERIFY'] = 'FAILURE'
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_equal 403, @response.status
+      end
+
+      test 'when "require_ssl_smart_proxies" and "require_ssl" are true, HTTP requests should not be able to get externalNodes' do
+        User.current = nil
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        SETTINGS[:require_ssl] = true
+
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_equal 403, @response.status
+      end
+
+      test 'when "require_ssl_smart_proxies" is true and "require_ssl" is false, HTTP requests should be able to get externalNodes' do
+        User.current = nil
+        # since require_ssl_smart_proxies is only applicable to HTTPS connections, both should be set
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        SETTINGS[:require_ssl] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['else.where'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }
+        assert_response :success
+      end
+
+      test 'authenticated users over HTTP should be able to get externalNodes' do
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        SETTINGS[:require_ssl] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['users.host'])
+        get :externalNodes, params: { name: host1.name, format: 'yml' }, session: set_session_user
+        assert_response :success
+      end
+
+      test 'authenticated users over HTTPS should be able to get externalNodes' do
+        Setting[:restrict_registered_smart_proxies] = true
+        Setting[:require_ssl_smart_proxies] = true
+        SETTINGS[:require_ssl] = false
+
+        Resolv.any_instance.stubs(:getnames).returns(['users.host'])
+        @request.env['HTTPS'] = 'on'
+        get :externalNodes, params: { name: host1.name, format: 'yml' }, session: set_session_user
+        assert_response :success
+      end
+    end
+  end
+end